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DETAILED ACTION 

1 . This Office action is in reply to applicant's response and amendment dated 21 January 
2004. Claims 1-33 remain pending. 

Drawings 

2. Acknowledgment is made of the replacement drawing sheets filed on 21 January 2004. 
The objection to the drawings is withdrawn. 

Claim Objections 

3. The objection to claim 7 regarding the minor informalities is withdrawn in view of the 
amendment. 

Claim Rejections - 35 USC §102 

4. The text of those sections of Title 35, U.S. Code not included in this action can be found 
in a prior Office action. 

5. Claims 26-33 are rejected under 35 U.S.C. 102(e) as being anticipated by U.S. Pat. No. 
6,026,235 to Shaughnessy, as set forth in the Office action of 22 October 2003 (Paper No. 8). 

With respect to amended claim 26, Shaughnessy discloses a method for intercepting a 
software call to a function contained in a dynamically linked library (see column 4, lines 14-27) 
comprising the steps of: 

(a) loading an executable program into memory (see column 5, lines 50-53, which shows 
loading applications into memory for execution); 
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(b) obtaining from an operating system by an intercepting program the address of an 
executable program (see column 9, lines 11-19, which shows obtaining address information from 
an executable program; note that determining the address of each and every function of a 
program is, in effect, determining the address of that program); 

(c) locating in a header of the executable program a list of libraries and functions called 
by the executable program (see step 301 in FIG. 3, and column 10, lines 19-27; note that the 
import table of an executable program is considered part of a header); 

(d) substituting a function reference in an import table of the executable program with a 
reference to a function in a library of the intercepting program (see step 303 in FIG. 3, and 
column 12, lines 52-55, which shows replacing function references in the executable with the 
addresses of stub functions); and 

(e) storing said function reference in an internal memory structure (see step 302 in FIG. 
3, and column 11, lines 31-34, which shows building tables of all function references; see also 
column 1 1 , lines 47-62, which shows the memory structure used for the tables). 

With respect to original claims 27-33, the grounds of rejection set forth in a prior Office 
action are maintained. See the explanations provided in the Office action of 22 October 2003 
(Paper No. 8). 

Claim Rejections - 35 USC §103 
6. Claims 1, 2, 5 and 25 are now rejected under 35 U.S.C. 103(a) as being unpatentable over 
U.S. Pat. No. 6,185,681 to Zizzi in view of U.S. Pat. No. 6,61 1,878 to De Armas et al. 
(hereinafter De Armas) in view of U.S. Pat. No. 6,637,023 to Ginsberg. 
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With respect to original claim 1, Zizzi discloses a method for associating the activity of 
an application with the graphical display of the file on a screen (see the title and abstract). 

Although Zizzi shows trapping event messages related to opening and closing documents 
sent to or from an application (see column 8 5 lines 32-42, and column 9, lines 44-54), for the 
purpose of enabling transparent document manipulation (see the title and abstract), Zizzi does 
not expressly disclose the steps of: 

(a) loading by an operating system an executable code of a message monitoring program 
adapted to monitoring a message sent by an operating system to a document display window; 

(b) establishing by the message monitoring program a system-wide window hook using 
available operating system API functions, said system-wide window hook associated with one or 
more functions in a library of said message monitoring program; 

(c) loading the message monitoring program library into the memory space of an 
application program, said application having been newly started and having an import table and a 
newly created window; 

(d) fixing the import table of the application with addresses of functions from the 
message monitoring program library; and 

(e) substituting the application's main window function with a message monitoring 
program window function. 

However, De Armas discloses step (a) above in terms of loading a program that monitors 
and intercepts all messages sent by an operating system to an application window (see column 5, 
lines 26-49). 
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De Armas further discloses step (b) above (see column 7, lines 56-63, which shows using 
an operating system API function to establish a system-wide hook for monitoring and 
intercepting messages). 

De Armas further discloses steps (c) and (e) above by first locating the memory space of 
an application with the address of its main window function, and then replacing this address with 
a pointer to a substitute window function from the program library of the monitoring program 
(see column 8, lines 35-54). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi with the steps taught by De Armas, for the purpose of 
seamlessly integrating new functionality into an existing program (see De Armas, column 2, 
lines 40-44), such as transparent encryption and decryption in a document management 
application (see Zizzi, title and abstract). 

Although De Armas discloses fixing the pointer to the application's window function 
with the address of a function from the monitoring program library (see column 8, lines 35-54), 
the combination of Zizzi and De Armas does not expressly disclose an import table as recited in 
step (d) above. 

However, Ginsberg discloses loading an application into RAM, including its import table, 
and modifying the import table in RAM by replacing references to a function library with new 
addresses (see steps 408 and 410 in FIG. 5, and column 5, lines 30-42). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi and De Armas with the steps taught by Ginsberg, for 



• 
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the purpose of updating an application without replacing the entire program (see Ginsberg, 
column 1, lines 40-48). 

With respect to original claim 2, the combination of Zizzi, De Armas and Ginsberg 
further discloses creating a key window when an application is started, said key window adapted 
to receive a message when a file is opened and closed (see De Armas, column 9, lines 5-17, 
which shows creating and using a surrogate window that receives messages from an application; 
note that any message sent from the operating system to the application will be routed to the 
surrogate window, including messages for opening and closing files). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi with the steps taught by De Armas, for the purpose of 
seamlessly integrating new functionality into an existing program (see De Armas, column 2, 
lines 40-44), such as transparent encryption and decryption in a document management 
application (see Zizzi, title and abstract). 

With respect to original claim 5, the combination of Zizzi, De Armas and Ginsberg 
further discloses, upon receipt of a document window destroy message by a document's notify 
window, checking for the existence of a child notify window associated with a file that was 
opened in association with said document, and acting upon said associated file before destroying 
said document window (see Zizzi, column 8, lines 32-42, which shows receiving event 
messages, including the "close" message that would destroy a document window; see also 
column 8, lines 59-67, and column 9, lines 1-7, which show checking whether the document 
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window, a client or child of the document management system, should be acted upon; see also 
column 9, lines 8-16 and 32-38, which shows acting upon the file before it is closed). 

With respect to original claim 25, the combination of Zizzi, De Armas and Ginsberg 
further discloses monitoring by the message monitoring program window function the creating 
of a document child window (see De Armas, column 5, lines 26-49, which shows a program that 
monitors and intercepts all messages sent by an operating system to an application window; note 
that all messages are intercepted, including those for creating document child windows). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi with the steps taught by De Armas, for the purpose of 
seamlessly integrating new functionality into an existing program (see De Armas, column 2, 
lines 40-44), such as transparent encryption and decryption in a document management 
application (see Zizzi, title and abstract). 

7. Claims 3 and 4 are now rejected under 35 U.S.C. 103(a) as being unpatentable over Zizzi 
in view of De Armas in view of Ginsberg, as applied to claims 2 and 1 above, respectively, and 
further in view of U.S. Pat. No. 6,604,150 to Gebhart et al. (hereinafter Gebhart). 

With respect to original claim 3, the combination of Zizzi, De Armas and Ginsberg does 
not expressly disclose: 

(a) sending a message to the key window when a file is opened; 

(b) creating a child notify window associated with said file; and 

(c) creating a notify window as a child window of a document window associated with 
said file. 
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However, Gebhart discloses steps (a), (b) and (c) above (see FIG. 5B, which shows 
sending messages to a key window, such as an open file message from an application; see also 
FIGS. 1 and 2, and column 5, lines 58-64, which show creating a dialog or notify window as a 
child window of a document window), for the purpose of integrating application extensions into 
a graphical user interface (see the title and abstract). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas and Ginsberg with the steps taught by 
Gebhart, for the purpose of integrating application extensions into a graphical user interface. 

With respect to original claim 4, the combination of Zizzi, De Armas and Ginsberg does 
not expressly disclose: 

(a) creating a notify window when a document window is created, wherein the notify 
window is a child window of the document window; and 

(b) receiving by the notify window a message from the operating system when the parent 
document window is activated by either the application program or by the action of a user. 

However, Gebhart discloses steps (a) and (b) above (see FIGS. 1 and 2, and column 5, 
lines 58-64, which show creating a dialog or notify window as a child window of a document 
window; see also column 6, lines 3-30, which shows that the dialog or notify window receives 
messages from the application and from the actions of a user), for the purpose of integrating 
application extensions into a graphical user interface (see the title and abstract). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas and Ginsberg with the steps taught by 
Gebhart, for the purpose of integrating application extensions into a graphical user interface. 
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8. Claims 6-9 are now rejected under 35 U.S.C. 103(a) as being unpatentable over Zizzi in 
view of De Armas in view of Ginsberg, as applied to claim 5 above, and further in view of U.S. 
Pat. No. 5,699,428 to McDonnal et al (hereinafter McDonnal). 

With respect to original claim 6, although the combination of Zizzi, De Armas and 
Ginsberg further discloses checking a file with a set of tests to determine whether or not the 
document should be acted upon (see Zizzi, column 8, lines 43-48), the combination does not 
expressly disclose the limitation comprising a user of an application specifying one or more rules 
to the application, each said rule indicating an action to be taken on said associated file before 
destroying said document window. 

However, McDonnal discloses the limitation above in terms of a rule file that is used to 
define the action to be taken on a document based on the user and other parameters (see column 
8, lines 35-49), for the purpose of enabling automatic decryption and encryption in response to 
file open and close events (see the abstract). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas and Ginsberg with the features taught by 
McDonnal, for the purpose of enabling automatic rule-based encryption and decryption in 
response to file open and close events. 

With respect to amended claim 7, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal further discloses the limitation wherein an action includes encrypting said associated 
file, wherein encrypting comprises: 



Application/Control Number: 09/855,425 Page 1 0 

Art Unit: 2122 

(a) creating a new file containing a template of the same format as said associated file, 
said new file including a header, wherein said header is not encrypted (see McDonnal, column 
28, lines 51-55, which shows creating a new file based on an associated file; see also column 29, 
lines 7-12, which shows including a security label in the new file; see also column 17, lines 48- 
49, which shows that the security label is a header); 

(b) copying to the new file a document summary in readable form (see McDonnal, 
column 18, lines 7-18, which shows copying summary information about a document to its 
security label, including the type of encryption algorithm used on the document and a list of 
authorized users); 

(c) copying to the new file visual indicia representing that the file is encrypted (see 
McDonnal, column 17, lines 64-67, which shows that the presence of a security label indicates 
that a file is encrypted); 

(d) copying encrypted data from the associated file to the new file as a named stream, 
said encrypted data having a beginning and a length (see McDonnal, column 29, lines 12-18, 
which shows copying encrypted data to a new file from an associated file; note that this data 
inherently has a beginning and a length); and 

(e) writing a code to a substitute stream to prevent the new file from being written over 
by a user (see McDonnal, column 19, lines 42-55, which shows using a unique, substitute file 
name so that data is not overwritten). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas and Ginsberg with the features taught by 
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McDonnal, for the purpose of enabling automatic rule-based encryption and decryption in 
response to file open and close events (see McDonnal, abstract). 

With respect to original claim 8, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal further discloses the step of including in the header a flag indicative of the type of 
encryption used on the associated file (see McDonnal, column 18, lines 7-12; see also Zizzi, 
column 3, lines 27-51, which shows several types of encryption). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas and Ginsberg with the features taught by 
McDonnal, for the purpose of enabling automatic rule-based encryption and decryption in 
response to file open and close events (see McDonnal, abstract). 

With respect to original claim 9, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal further discloses the step of including in the header a flag indicative of a handling 
procedure to be used on the associated file (see McDonnal, column 18, lines 30-35, which shows 
an encryption key stored in the security label of a file, which is needed to determine the 
procedure for handling the file; see also Zizzi, column 9, lines 17-22, which shows obtaining an 
encryption key associated with a document, establishing the procedure to be used on the file). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas and Ginsberg with the features taught by 
McDonnal, for the purpose of enabling automatic rule-based encryption and decryption in 
response to file open and close events (see McDonnal, abstract). 
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9. Claims 10 and 1 1 are now rejected under 35 U.S.C. 103(a) as being unpatentable over 
Zizzi in view of De Armas in view of Ginsberg in view of McDonnal, as applied to claim 7 
above, and further in view of U.S. Pat. No. 5,757,908 to Cooper et al. (hereinafter Cooper). 

With respect to original claim 10, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the step of loading data from the encrypted file into a 
memory block containing other random data, said memory block having a beginning, wherein an 
offset from the beginning of the memory block of the data from the encrypted file changes each 
time the message monitoring program executable code is loaded. 

However, Cooper discloses the step above for the purpose of securing access to files (see 
column 3, lines 50-63, which shows that data from an encrypted file is copied to memory; note 
that the memory inherently contains other random data, and that the offset from the beginning of 
the memory to the location of the encrypted data inherently changes). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the features 
taught by Cooper, for the purpose of securing access to files. 

With respect to original claim 1 1, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the step of including in the header a flag indicative of the 
length of the encrypted data, and a flag that allows the message monitoring program to search for 
the beginning of the encrypted data. 

However, Cooper discloses the step above in terms of an encryption header in a system 
for securing files (see FIG. 24 and column 17, lines 17-34, which shows a header field for the 
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offset to a side file, i.e. a flag indicating the beginning of encrypted data; see also FIG. 26 and 
column 18, lines 57-65, which shows a header field for the length of a side file, i.e. a flag 
indicating the length of encrypted data), for the purpose of keeping the size of the encrypted file 
the same as the size of the original file (see column 17, lines 12-16). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the 
encryption header taught by Cooper, for the purpose of maintaining a particular file size. 

10. Claims 14, 16 and 23 are now rejected under 35 U.S.C. 103(a) as being unpatentable over 
Zizzi in view of De Armas in view of Ginsberg in view of McDonnal, as applied to claim 6 
above, and further in view of U.S. Pat. No. 6,230,310 to Arrouye et al. (hereinafter Arrouye). 

With respect to original claim 14, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes compressing 
said associated file. 

However, Arrouye discloses the limitation above (see block 30 in FIG. 1, and column 4, 
lines 38-51, which show compressing and decompressing files) in a system for transparently 
transforming objects so that they can be used by applications (see the title and abstract). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the feature 
taught by Arrouye, so that the application can use non-native files, including those that require 
compression or decompression. 
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With respect to original claim 16, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes converting said 
associated file into another file format. 

However, Arrouye discloses the limitation above (see block 26 in FIG. 1, and column 4, 
lines 5-21, which show converting files to other formats) in a system for transparently 
transforming objects so that they can be used by applications (see the title and abstract). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the feature 
taught by Arrouye, so that the application can use non-native files, including those that must be 
converted from another format. 

With respect to original claim 23, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes storing said 
associated file content in a remote location, and storing a reference of said associated file locally. 

However, Arrouye discloses the limitation above (see block 28 in FIG. 1, and column 4, 
lines 22-37, which show retrieving files from remote locations) in a system for transparently 
transforming objects so that they can be used by applications (see the title and abstract). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the feature 
taught by Arrouye, so that the application can use non-native files, including those stored at 
remote locations. 
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11. Claims 15, 18, 20 and 24 are now rejected under 35 U.S.C. 103(a) as being unpatentable 
over Zizzi in view of De Armas in view of Ginsberg in view of McDonnal, as applied to claim 6 
above, and further in view of U.S. Pat. No. 5,884,246 to Boucher et al. (hereinafter Boucher). 

With respect to original claim 15, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes translating said 
associated file into another language. 

However, Boucher discloses the limitation above in terms of a system for transparently 
translating messages into other languages (see column 2, lines 7-15), for the purpose of 
enhancing communications in multilingual environments (see column 1, lines 60-67). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the 
translation feature taught by Boucher, for the purpose of enhancing communications in 
multilingual environments. 

With respect to original claim 18, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes altering text in 
said associated file. 

However, Boucher discloses the limitation above in terms of a system for transparently 
translating messages into other languages (see column 12, lines 17-26, which shows altering text 
in the message or file by removing certain portions), for the purpose of enhancing 
communications in multilingual environments (see column 1, lines 60-67). 
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It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the text- 
altering feature taught by Boucher, for the purpose of enhancing communications in multilingual 
environments. 

With respect to original claim 20, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes spell checking 
said associated file. 

However, Boucher discloses the limitation above in terms of a system for transparently 
translating messages into other languages (see column 12, lines 15-17, which shows spell 
checking the message or file) for the purpose of enhancing communications in multilingual 
environments (see column 1, lines 60-67). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the spell- 
checking feature taught by Boucher, for the purpose of enhancing communications in 
multilingual environments. 

With respect to original claim 24, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes grammar 
checking said associated file. 

However, Boucher discloses the limitation above in terms of a system for transparently 
translating messages into other languages (see column 12, lines 15-17, which shows grammar 
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checking the message or file) for the purpose of enhancing communications in multilingual 
environments (see column 1, lines 60-67). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the grammar- 
checking feature taught by Boucher, for the purpose of enhancing communications in 
multilingual environments. 

12. Claims 17 and 19 are now rejected under 35 U.S.C. 103(a) as being unpatentable over 
Zizzi in view of De Armas in view of Ginsberg in view of McDonnal, as applied to claim 6 
above, and further in view of U.S. Pat. No. 5,956,481 to Walsh et al. (hereinafter Walsh). 

With respect to original claim 17, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes searching for a 
virus in said associated file. 

However, Walsh discloses the limitation above in terms of a virus protection system (see 
column 10, lines 17-34, which shows that documents are scanned when a file event is detected), 
used to warn users about potential viruses (see column 10, lines 35-42). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the virus 
detection features taught by Walsh, for the purpose of warning users about potential viruses. 

With respect to original claim 19, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes changing or 
adding an optional setting to said associated file. 
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However, Walsh discloses the limitation above in terms of a virus protection system (see 
column 11, lines 16-26, which shows changing the read only setting of a file), used to prevent the 
spread of viruses (see column 11, lines 26-28). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the file 
attribute features taught by Walsh, for the purpose of preventing the spread of viruses. 

13. Claims 21 and 22 are now rejected under 35 U.S.C 103(a) as being unpatentable over 
Zizzi in view of De Armas in view of Ginsberg in view of McDonnal as applied to claim 6 
above, and further in view of U.S. Pat. No. 6,629,109 to Koshisaka. 

With respect to original claim 21, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes creating a 
backup of said associated file. 

However, Koshisaka discloses the limitation above in terms of monitoring system 
messages and generating backup files (see column 2, lines 5-21), for the purpose of enabling 
revision and backup management in applications that do not already have such features (see 
column 1, lines 58-64). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the features 
taught by Koshisaka, in order to integrate revision and backup management into the application. 
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With respect to original claim 22, the combination of Zizzi, De Armas, Ginsberg and 
McDonnal does not expressly disclose the limitation wherein an action includes versioning said 
associated file under a different name or stream each time said associated file is saved. 

However, Koshisaka discloses the limitation above in terms of monitoring system 
messages and generating backup files (see column 2, lines 5-21; see also FIG. 4, which shows 
that different file names are used when files are manipulated), for the purpose of enabling 
revision and backup management in applications that do not already have such features (see 
column 1, lines 58-64). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to modify the method of Zizzi, De Armas, Ginsberg and McDonnal with the features 
taught by Koshisaka, in order to integrate revision and backup management into the application. 

14. Claims 26-33 are also rejected under 35 U.S.C. 103(a) as being unpatentable over 
Shaughnessy in view of Ginsberg. 

With respect to amended claim 26, Shaughnessy discloses a method for intercepting a 
software call to a function contained in a dynamically linked library (see column 4, lines 14-27) 
comprising the steps of: 

(a) loading an executable program into memory (see column 5, lines 50-53, which shows 
loading applications into memory for execution); 

(b) obtaining from an operating system by an intercepting program the address of an 
executable program (see column 9, lines 11-19, which shows obtaining address information from 
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an executable program; note that determining the address of each and every function of a 
program is, in effect, determining the address of that program); 

(c) locating in a header of the executable program a list of libraries and functions called 
by the executable program (see step 301 in FIG. 3, and column 10, lines 19-27; note that the 
import table of an executable program is considered part of a header); 

(d) substituting a function reference in an import table of the executable program with a 
reference to a function in a library of the intercepting program (see step 303 in FIG. 3, and 
column 12, lines 52-55, which shows replacing function references in the executable with the 
addresses of stub functions); and 

(e) storing said function reference in an internal memory structure (see step 302 in FIG. 
3, and column 1 1, lines 31-34, which shows building tables of all function references; see also 
column 1 1, lines 47-62, which shows the memory structure used for the tables). 

Furthermore, Ginsberg discloses loading an application into RAM, including its import 
table, and modifying the import table in RAM by replacing references to a function library with 
new addresses (see steps 408 and 410 in FIG. 5, and column 5, lines 30-42). 

It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to enhance the method of Shaughnessy, which is for monitoring an application by 
updating its function references (see Shaughnessy, FIG. 3, title and abstract), with the steps 
expressly taught by Ginsberg, for the purpose of updating the application without replacing the 
entire program (see Ginsberg, column 1, lines 40-48). 

With respect to original claims 27-33, see the reasoning set forth in paragraph 5 above. 
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Allowable Subject Matter 



15. Claims 12 and 13 are objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the base 
claim and any intervening claims. 

Response to Arguments 

16. Applicant's arguments with respect to claims 1-33 are moot in view of the new ground(s) 
of rejection. 

With respect to claims 1-25, applicant contends that neither Zizzi nor De Armas teach or 
suggest fixing the import table of the application with addresses of functions from a message 
monitoring program library (see page 15, second paragraph). However, the newly cited 
Ginsberg reference discloses loading an application and its import table into RAM, and 
modifying the import table in RAM by replacing references to a function library with new 
addresses (see steps 408 and 410 in FIG. 5, and column 5, lines 30-42), as set forth above. 

Applicant also contends that neither Zizzi nor De Armas teach or suggest substituting the 
application's main window function with a message monitoring window function (see page 15, 
second paragraph). However, as noted above, De Armas expressly discloses this limitation in 
terms of replacing the address of a program's window procedure with a pointer to a substitute 
window procedure from a library of the monitoring program (see column 8, lines 35-54). 

With respect to claims 26-33, applicant contends that the claimed invention differs from 
the Shaughnessy reference in that the executable file itself is not modified by the invention, and 
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that Shaughnessy neither teaches nor suggests altering a memory-resident import table (see page 
12, last paragraph to page 13, first paragraph). However, the newly cited Ginsberg reference 
discloses loading an application and its import table into RAM, and modifying the import table 
in RAM by replacing references to a function library with new addresses (see steps 408 and 410 
in FIG. 5, and column 5, lines 30-42), as set forth above. 

Furthermore, the plain language of amended claim 26 does not exclude the teachings of 
Shaughnessy, which show loading an executable program into memory (see column 5, lines 50- 
53) as well as substituting function references in the import table of such a program (see step 303 
in FIG. 3 and column 12, lines 52-55). As well, the storage device on which the executable files 
of Shaughnessy reside is considered to be a form of memory, and therefore any modifications 
made to the import tables necessarily occur in memory. 

Applicant also contents that column 9, lines 1 1-19 in the Shaughnessy reference does not 
teach or suggest obtaining the address of an executable program from an operating system. 
However, as set forth above, Shaughnessy does disclose obtaining address information 
associated with an executable program (see column 9, lines 11-19). Determining the memory 
address of each and every function of a program is functionally equivalent to determining the 
address of that program. It is further noted that the address of the program is inherently obtained 
in some manner in order to find and then alter the import table, as is done by Shaughnessy (see 
step 303 in FIG. 3). 



17. Applicant's arguments with respect to claims 1, 2, 5 and 25 have been fully considered 
but they are not persuasive, as discussed below. 
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18. In response to applicant's argument that the examiner's conclusion of obviousness is 
based upon improper hindsight reasoning (see page 13, last paragraph), it must be recognized 
that any judgment on obviousness is in a sense necessarily a reconstruction based upon hindsight 
reasoning. But so long as it takes into account only knowledge which was within the level of 
ordinary skill at the time the claimed invention was made, and does not include knowledge 
gleaned only from the applicant's disclosure, such a reconstruction is proper. See In re 
McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 1971). 

19. In response to applicant's argument that there is no suggestion to combine the references 
(see page 14, first paragraph), the examiner recognizes that obviousness can only be established 
by combining or modifying the teachings of the prior art to produce the claimed invention where 
there is some teaching, suggestion, or motivation to do so found either in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art. See In re 
Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988) and/w re Jones, 958 F.2d 347, 21 
USPQ2d 1941 (Fed. Cir. 1992). 

In this case, Zizzi discloses a method for enabling transparent encryption and decryption 
in a document management application (see Zizzi, title and abstract). De Armas then teaches 
message monitoring steps not expressly disclosed by Zizzi, for the purpose of seamlessly 
integrating new functionality into an existing program (see De Armas, column 2, lines 40-44). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention 
was made to combine the method of Zizzi with the steps taught by De Armas. 
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20. In response to applicant's argument that the references fail to show certain features of 
applicant's invention (see page 14, second paragraph to page 15, first paragraph), it is noted that 
the features upon which applicant relies (i.e., intercepting hard drive accesses at a lower level to 
provide stronger encryption) are not recited in the rejected claim(s). Although the claims are 
interpreted in light of the specification, limitations from the specification are not read into the 
claims. See In re Van Geuns, 988 F.2d 1 181, 26 USPQ2d 1057 (Fed Cir. 1993). 



2 1 . Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael J. Yigdall whose telephone number is (703) 305-0352. 
The examiner can normally be reached on Monday through Friday from 8:00am to 4:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Tuan Q, Dam can be reached on (703) 305-4552. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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